Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68777
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain marc-bennewitz.de from 80.237.132.171 cause and error)
Message-ID: <5221C5A4.8090609@marc-bennewitz.de>
Date: Sat, 31 Aug 2013 12:29:56 +0200
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130803 Thunderbird/17.0.8
MIME-Version: 1.0
To: internals@lists.php.net
References: <521E64B6.30703@marc-bennewitz.de> <521F37E5.5040203@gmail.com> <CAGa2bXbcEZDUwmvTWdp3E73oytjSbLyYT7YA+E=KBQt5UAv-AA@mail.gmail.com> <5220F973.5000000@marc-bennewitz.de> <001701cea5e7$e872d030$b9587090$@org>
In-Reply-To: <001701cea5e7$e872d030$b9587090$@org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] More powerful (and backward compatible) API of random
 number generator functions
From: php@marc-bennewitz.de (Marc Bennewitz)

Am 31.08.2013 03:17, schrieb Bryan C. Geraghty:
> First, I want to ask: Does anyone else think we should draw a distinction between RNGs and CSPRNGs?
> 
> I ask this because the OpenSSL option here is the only CSPRNG; The others are trivially breakable and should not be used for cryptographic applications. I could see an argument for wanting to use them in non-security contexts but I'm wondering if the API should make it clear when that is being done.
> 
> Secondly, a good place to look for defining a standard secure CSPRNG is FIPS 1402 Annex C (csrc.nist.gov/publications/fips/fips140-2/fips1402annexc.pdf‎)
The listed constants are the one currently available in PHP. No more no
less.

I agree to have a CSPRNG defined as default but this should be the case
on all systems also without openssl dev/urandom ... (I don't know if
FIPS 1402 Annex C works on all systems).

For other modules like openssl/gmp it should be possible to add there
own algorithm that can be used with the same simple API.

> 
> Bryan
> 
> -----Original Message-----
> From: Marc Bennewitz [mailto:php@marc-bennewitz.de] 
> Sent: Friday, August 30, 2013 2:59 PM
> To: internals@lists.php.net
> Subject: Re: [PHP-DEV] More powerful (and backward compatible) API of random number generator functions
> 
> Am 30.08.2013 04:30, schrieb Yasuo Ohgaki:
>> On Thu, Aug 29, 2013 at 9:00 PM, Ángel González <keisial@gmail.com> wrote:
>>
>>> Marc Bennewitz wrote:
>>>
>>>> Idea for an RFC for a more powerful (and backward compatible) API of 
>>>> random number generator functions.
>>>>
>>>> The following psaudocode is self explained (hopfully)
>>>>
>>>> const RAND_ALGO_LIBC
>>>> const RAND_ALGO_MERSENNE_TWISTER
>>>> const RAND_ALGO_OPENSSL
>>>> const RAND_ALGO_GMP
>>>>
>>> (...)
>>>
>>>> What do you think?
>>>>
>>>
>>> Why do you want them?
>>
>>
>> This proposal is good because we need the best random function 
>> available in a system with easy to use API. I would like to see the 
>> best algorithm in a system as default.
>>
> 
> Defining the "best" algorithm as the standard default would be great but what is the best algorithm? Some are fast but less secure and other are more secure but slow.
> 
> Some times ago i read a feature request to implement the mersenne twister algorithm for rand/shuffle/array_rand but this was closed because it would be a bc break. (can't find it new).
> 
> Best Regards
> Marc
> 
> --
> PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php
> 
>